Three Statistical Approaches to Sessionizing Network Flow Data

Rubin-Delanchy, Patrick; Lawson, Daniel J.; Turcotte, Melissa; Heard, Nicholas A.; Adams, Niall M.

doi:10.1109/jisic.2014.46

Cited by 3 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The traffic a host generates is often seen as a series of session, which are intervals of time during which the host is engaging in the same, continued, activity [13]. In our context, flows that occur during the same session can be seen as having strong short-term dependencies.…”

Section: Session Constructionmentioning

confidence: 99%

See 1 more Smart Citation

Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs

Clausen

Grov

Sabate

et al. 2021

Machine Learning for Networking

View full text Add to dashboard Cite

Recent evaluations show that the current anomaly-based network intrusion detection methods fail to detect remote access attacks reliably [10]. Here, we present a deep bidirectional LSTM approach that is designed specifically to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities to identify contextual anomalies. To verify our improvements on current detection rates, we re-implemented and evaluated three state-of-the-art methods in the field. We compared results on an assembly of datasets that provides both representative network access attacks as well as real normal traffic over a long timespan, which we contend is closer to a potential deployment environment than current NIDS benchmark datasets. We show that by building a deep model, we are able to reduce the false positive rate to 0.16% while detecting effectively, which is significantly lower than the operational range of other methods. Furthermore, we reduce overall misclassification by more than 100% from the next best method.

show abstract

Section: Session Constructionmentioning

confidence: 99%

“…In our context, flows that occur during the same session can be seen as having strong short-term dependencies. We therefore group flows going from or to the same host to sessions using an established statistical approach [13]:…”

Section: Session Constructionmentioning

confidence: 99%

Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs

Clausen

Grov

Sabate

et al. 2021

Machine Learning for Networking

View full text Add to dashboard Cite

show abstract

“…The traffic a host generates is often seen as a series of sessions, which are intervals of time during which the host is engaged in the same continued activity [9]. In our context, flows that occur during the same session can be seen as having strong short-term dependencies.…”

Section: Session Constructionmentioning

confidence: 99%

Section: Session Constructionmentioning

confidence: 99%

“…We chose the number of α = 8 seconds as we have found that on average, around 90% of flows on a host start less than 8 seconds after the previous flow, a suitable threshold to create cohesive sessions according to Rubin-Delanchy et al [9]. We introduced the β parameter in order to break up long sessions that potentially contain a small amount of malicious flows and estimated β = 25 to be a suitable parameter.…”

Section: Session Constructionmentioning

confidence: 99%

See 1 more Smart Citation

CBAM: A Contextual Model for Network Anomaly Detection

2021

View full text Add to dashboard Cite

Anomaly-based intrusion detection methods aim to combat the increasing rate of zero-day attacks, however, their success is currently restricted to the detection of high-volume attacks using aggregated traffic features. Recent evaluations show that the current anomaly-based network intrusion detection methods fail to reliably detect remote access attacks. These are smaller in volume and often only stand out when compared to their surroundings. Currently, anomaly methods try to detect access attack events mainly as point anomalies and neglect the context they appear in. We present and examine a contextual bidirectional anomaly model (CBAM) based on deep LSTM-networks that is specifically designed to detect such attacks as contextual network anomalies. The model efficiently learns short-term sequential patterns in network flows as conditional event probabilities. Access attacks frequently break these patterns when exploiting vulnerabilities, and can thus be detected as contextual anomalies. We evaluated CBAM on an assembly of three datasets that provide both representative network access attacks, real-life traffic over a long timespan, and traffic from a real-world red-team attack. We contend that this assembly is closer to a potential deployment environment than current NIDS benchmark datasets. We show that, by building a deep model, we are able to reduce the false positive rate to 0.16% while effectively detecting six out of seven access attacks, which is significantly lower than the operational range of other methods. We further demonstrate that short-term flow structures remain stable over long periods of time, making the CBAM robust against concept drift.

show abstract

Disassortativity of computer networks

Rubin-Delanchy

Adams

Heard

2016

2016 IEEE Conference on Intelligence and Security Informatics (ISI)

Self Cite

View full text Add to dashboard Cite

Abstract-Network data is ubiquitous in cyber-security applications. Accurately modelling such data allows discovery of anomalous edges, subgraphs or paths, and is key to many signature-free cyber-security analytics. We present a recurring property of graphs originating from cyber-security applications, often considered a 'corner case' in the main literature on network data analysis, that greatly affects the performance of standard 'off-the-shelf' techniques. This is the property that similarity, in terms of network behaviour, does not imply connectivity, and in fact the reverse is often true. We call this disassortivity. The phenomenon is illustrated using network flow data collected on an enterprise network. Improved procedures are proposed, that take explicit account of this property, for spectral analysis and link prediction.

show abstract

Three Statistical Approaches to Sessionizing Network Flow Data

Cited by 3 publications

References 12 publications

Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs

Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs

CBAM: A Contextual Model for Network Anomaly Detection

Disassortativity of computer networks

Contact Info

Product

Resources

About